{"id":"ghsa-ghsa-2hw4-c9m4-f2fj","seq":2056911,"kind":"advisory","title":"knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion","url":"https://github.com/advisories/GHSA-2hw4-c9m4-f2fj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2hw4-c9m4-f2fj","summary":"影響: go:knative.dev/pkg < 0.0.0-20260531000007-52dbd5ece63f → 0.0.0-20260531000007-52dbd5ece63f\n⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — 4.5× amplification observed (worse than the advisory's conservative 2× claim) Built a Go PoC ([cmd/poc-c2/main.go](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/cmd/poc-c2/main.go)) that runs the exact 8-line vulnerable snippet from [webhook/admission.go:109-117](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/webhook/admission.go#L109-L117) verbatim under the same http.H…","severity":"medium","techs":["go","github"],"cves":[],"tags":["GHSA-2hw4-c9m4-f2fj","knative.dev/pkg"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:20:53.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}